<html>
<head><meta charset="utf-8"><title>unchecked arithmetic · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html">unchecked arithmetic</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="215761352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215761352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215761352">(Nov 05 2020 at 19:22)</a>:</h4>
<p>Hi there <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>
<p>I came across this issue about (un-)checked integer arithmetic in Rust: <a href="https://github.com/rust-lang/rust/issues/9469">https://github.com/rust-lang/rust/issues/9469</a><br>
The discussion is rather old and I wanted to ask if in the meanwhile the Rust community came to consensus about whether arithmetic in Rust should be checked by default or not?</p>
<p>As a security-focussed guy I would prefer to have arithmetic checked by default. I saw a some of memory-safety issues arising from it, even in Rust code (<a href="https://rustsec.org/advisories/CVE-2018-1000810.html">https://rustsec.org/advisories/CVE-2018-1000810.html</a>). <br>
I can understand the performance concerns discussed in Issue <a href="https://github.com/rust-lang/rust/issues/9469">#9469</a> but they are quite old. Did the sitation change? Isn't Rust widely perceived a fast-enough contender for C/C++ now? =&gt; <a href="https://github.com/rust-lang/rust/issues/9469#issuecomment-32135246">https://github.com/rust-lang/rust/issues/9469#issuecomment-32135246</a></p>
<p>My personal impression when starting with Rust was that "security's first": everything is checked outside of unsafe blocks - even arithmetic. So it it was quite a bummer for me to see that arithmetic is not checked by default. Maybe other new Rust programmers will perceive it the same way and could produce buggy code because it's not explicitly visible that default arithmetic operations (+, -, ...) can overflow, etc. <br>
I think one of Rust's most honorable objectives is to make unsafe behavior explicitly visible in the code - making it easy for reviewers.</p>



<a name="215761441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215761441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215761441">(Nov 05 2020 at 19:23)</a>:</h4>
<p><span class="user-mention" data-user-id="245622">@Oliver Braunsdorf</span> arithmetic is checked in debug mode and wrapping in release mode</p>



<a name="215761445"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215761445" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215761445">(Nov 05 2020 at 19:23)</a>:</h4>
<p><a href="https://github.com/rust-lang/rfcs/pull/2635">https://github.com/rust-lang/rfcs/pull/2635</a> was my somewhat novel approach to this. It keeps getting blocked by missed optimizations in LLVM though.</p>



<a name="215761455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215761455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215761455">(Nov 05 2020 at 19:23)</a>:</h4>
<p>I don't think it's had unchecked arithmetic for a while</p>



<a name="215762027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215762027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215762027">(Nov 05 2020 at 19:27)</a>:</h4>
<p>there's also this pre-RFC: <a href="https://internals.rust-lang.org/t/where-is-std-saturating-going-to-pre-rfc/13053/27">https://internals.rust-lang.org/t/where-is-std-saturating-going-to-pre-rfc/13053/27</a></p>



<a name="215763736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215763736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215763736">(Nov 05 2020 at 19:40)</a>:</h4>
<p>ah intersting, so it seems like this is still a topic..<br>
<span class="user-mention" data-user-id="130046">@Alex Gaynor</span> seems like your RFC is on the way to getting accepted. Why did you propose it only for usize?</p>



<a name="215763769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215763769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215763769">(Nov 05 2020 at 19:40)</a>:</h4>
<p>Balance of perf/security.</p>



<a name="215763870"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215763870" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215763870">(Nov 05 2020 at 19:41)</a>:</h4>
<p>okay :D</p>



<a name="215764053"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764053" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764053">(Nov 05 2020 at 19:42)</a>:</h4>
<p>did anyone ever proposed to abandon default operators like "+" or "-" and only have either checked_add or unchecked_add?</p>



<a name="215764059"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764059" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764059">(Nov 05 2020 at 19:42)</a>:</h4>
<p>I would really hate that</p>



<a name="215764075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764075">(Nov 05 2020 at 19:42)</a>:</h4>
<p>imagine how much noise that adds</p>



<a name="215764080"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764080" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764080">(Nov 05 2020 at 19:42)</a>:</h4>
<p>would be a bold proposal though :D</p>



<a name="215764083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764083">(Nov 05 2020 at 19:42)</a>:</h4>
<p>I think such a proposal is DOA</p>



<a name="215764170"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764170" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764170">(Nov 05 2020 at 19:43)</a>:</h4>
<p>yes..i would totally feel that, too</p>



<a name="215764727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764727">(Nov 05 2020 at 19:48)</a>:</h4>
<p>Can you tell me what would be current best practice to detect such bugs in Rust? Can Miri detect potential overflows?</p>



<a name="215764847"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764847" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764847">(Nov 05 2020 at 19:48)</a>:</h4>
<p>well, you can <code>deny(clippy::integer_arithmetic)</code> if you want <a href="https://rust-lang.github.io/rust-clippy/master/index.html#integer_arithmetic">https://rust-lang.github.io/rust-clippy/master/index.html#integer_arithmetic</a></p>



<a name="215764873"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764873" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764873">(Nov 05 2020 at 19:49)</a>:</h4>
<p>and if you have overflows in constants those give <code>const_err</code></p>



<a name="215764901"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764901" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764901">(Nov 05 2020 at 19:49)</a>:</h4>
<p>but other than that I don't think there's any static analysis for it</p>



<a name="215764921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764921">(Nov 05 2020 at 19:49)</a>:</h4>
<p>You can also just turn it on in release mode</p>



<a name="215764923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764923">(Nov 05 2020 at 19:49)</a>:</h4>
<p>I did use <code>deny(clippy::integer_arithmetic)</code> in one of my projects, yes</p>



<a name="215764958"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764958" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764958">(Nov 05 2020 at 19:49)</a>:</h4>
<p><span class="user-mention silent" data-user-id="127617">Shnatsel</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215764923">said</a>:</p>
<blockquote>
<p>I did use <code>deny(clippy::integer_arithmetic)</code> in one of my projects, yes</p>
</blockquote>
<p>I'm surprised to hear that, I consider it one of the more pedantic lints. Which project?</p>



<a name="215764983"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764983" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jonas Schievink  [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764983">(Nov 05 2020 at 19:49)</a>:</h4>
<p>Overflow checks, that is</p>



<a name="215764984"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215764984" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215764984">(Nov 05 2020 at 19:49)</a>:</h4>
<p><a href="https://github.com/viperproject/prusti-dev/">https://github.com/viperproject/prusti-dev/</a> would be able to prove absence of overflows, once complete</p>



<a name="215765061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765061">(Nov 05 2020 at 19:50)</a>:</h4>
<p>I used that in <a href="https://github.com/Shnatsel/binfarce">https://github.com/Shnatsel/binfarce</a></p>



<a name="215765122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765122">(Nov 05 2020 at 19:50)</a>:</h4>
<p>Example: <a href="https://github.com/Shnatsel/binfarce/blob/master/src/elf64.rs">https://github.com/Shnatsel/binfarce/blob/master/src/elf64.rs</a></p>



<a name="215765319"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765319" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765319">(Nov 05 2020 at 19:52)</a>:</h4>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="cp">#![deny(clippy::integer_arithmetic)]</span><span class="w"></span>
<span class="cp">#![deny(clippy::cast_possible_truncation)]</span><span class="w"></span>
<span class="cp">#![deny(clippy::indexing_slicing)]</span><span class="w"></span>
</code></pre></div>
<p>is the full set of things denied in there. Should eliminate most causes of panics in a binary format parser</p>



<a name="215765711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765711">(Nov 05 2020 at 19:55)</a>:</h4>
<p>That entire crate was just me looking at <code>goblin</code>, thinking that I don't need 90% of it and there's no way I can prevent that entire thing from either panicking or OOMing on malformed input, and then rolling my own parser for a small subset of ELF/Mach-O/PE that I can statically prevent from OOMing (no allocations) and usually even panicking (clippy lints)</p>



<a name="215765855"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765855" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765855">(Nov 05 2020 at 19:56)</a>:</h4>
<p>Although "no panics" is just something I've thrown in because I could, that's not an actual requirement for what I'm building on top of it - <a href="https://github.com/Shnatsel/rust-audit">https://github.com/Shnatsel/rust-audit</a></p>



<a name="215765955"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215765955" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215765955">(Nov 05 2020 at 19:57)</a>:</h4>
<p>The only thing left to do there is uplift it into cargo itself, which is something I didn't even start tackling yet. Working on <a href="https://github.com/rust-secure-code/cargo-supply-chain">https://github.com/rust-secure-code/cargo-supply-chain</a> in the meanwhile</p>



<a name="215766191"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215766191" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215766191">(Nov 05 2020 at 19:58)</a>:</h4>
<p>Which works, by the way, and the only thing left to do is writing an announcement</p>



<a name="215769494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215769494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215769494">(Nov 05 2020 at 20:27)</a>:</h4>
<p>Ah, great to know that clippy has lints for this! Although "no bounds analysis or sophisticated reasoning is attempted".<br>
Having Prusti's powers ready for productive use will be great, but until then it might be a good starting point for me to write a more sophisticated static analysis to check for potential overflows.</p>



<a name="215769721"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215769721" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215769721">(Nov 05 2020 at 20:29)</a>:</h4>
<p><span class="user-mention silent" data-user-id="211727">Jonas Schievink</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215764921">said</a>:</p>
<blockquote>
<p>You can also just turn it on in release mode</p>
</blockquote>
<p>also interesting! <span class="user-mention" data-user-id="211727">@Jonas Schievink</span>  can you tell me how to enable this?</p>



<a name="215773446"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215773446" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215773446">(Nov 05 2020 at 21:01)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245622">Oliver Braunsdorf</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215769721">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="211727">Jonas Schievink</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215764921">said</a>:</p>
<blockquote>
<p>You can also just turn it on in release mode</p>
</blockquote>
<p>also interesting! <span class="user-mention silent" data-user-id="211727">Jonas Schievink</span>  can you tell me how to enable this?</p>
</blockquote>
<p>nevermind. found it here: <a href="https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled">https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled</a><br>
Thanks for the info :)</p>



<a name="215788300"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215788300" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215788300">(Nov 05 2020 at 23:39)</a>:</h4>
<blockquote>
<p>did anyone ever proposed to abandon default operators like "+" or "-" and only have either checked_add or unchecked_add?</p>
</blockquote>
<p><span class="user-mention" data-user-id="245622">@Oliver Braunsdorf</span> a better alternative to this, I think, is an attribute or a macro which defines what kind of behavior you want for a particular block of code</p>



<a name="215788369"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215788369" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215788369">(Nov 05 2020 at 23:40)</a>:</h4>
<p>like</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="cp">#[checked]</span><span class="w"></span>
<span class="k">fn</span> <span class="nf">myarith</span><span class="p">(</span><span class="n">x</span>: <span class="kt">u64</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u64</span> <span class="p">{</span><span class="w"> </span><span class="o">..</span><span class="p">.</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="215788412"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215788412" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215788412">(Nov 05 2020 at 23:40)</a>:</h4>
<p>or:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">checked</span><span class="o">!</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">y</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="215788443"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215788443" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215788443">(Nov 05 2020 at 23:41)</a>:</h4>
<p>although personally I'd be happy to settle for <code>Checked</code> as part of the standard library crates</p>



<a name="215788601"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215788601" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215788601">(Nov 05 2020 at 23:43)</a>:</h4>
<p>do you see specific advantages of this over the <code>checked_add</code> family of functions already existing in the standard library?</p>



<a name="215789068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215789068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215789068">(Nov 05 2020 at 23:50)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215788300">said</a>:</p>
<blockquote>
<p>a better alternative to this, I think, is an attribute or a macro which defines what kind of behavior you want for a particular block of code</p>
</blockquote>
<p>That exists: <a href="https://github.com/llogiq/overflower">https://github.com/llogiq/overflower</a></p>



<a name="215868121"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215868121" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215868121">(Nov 06 2020 at 16:17)</a>:</h4>
<p>I know that exists. There's also the <code>checked</code> crate. But I don't want to pull in another dependency</p>



<a name="215868172"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215868172" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215868172">(Nov 06 2020 at 16:17)</a>:</h4>
<blockquote>
<p>do you see specific advantages of this over the checked_add family of functions already existing in the standard library?</p>
</blockquote>
<p><span class="user-mention" data-user-id="245622">@Oliver Braunsdorf</span>  I am a power user of <code>checked_*</code> and I find it really annoying to use</p>



<a name="215877027"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215877027" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215877027">(Nov 06 2020 at 17:22)</a>:</h4>
<p>okay, I understand. Whatever a solution looks like, it should be very ergonomic for developers to use.</p>
<p><span class="user-mention silent" data-user-id="127617">Shnatsel</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215789068">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215788300">said</a>:</p>
<blockquote>
<p>a better alternative to this, I think, is an attribute or a macro which defines what kind of behavior you want for a particular block of code</p>
</blockquote>
<p>That exists: <a href="https://github.com/llogiq/overflower">https://github.com/llogiq/overflower</a></p>
</blockquote>
<p>I think I like the approach of overflower. Didn't look into it much, but it seems like you could define <code>#[overflow(panic)]</code> for the whole crate and then use <code>#[overflow(wrap)]</code> as exception at function level or instruction level</p>



<a name="215877530"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215877530" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Oliver Braunsdorf <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215877530">(Nov 06 2020 at 17:26)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> you're writing a lot of crypto code, right? Do you think it would be less annoying for you to mark unchecked arithmetic at function level oder module level? - Imagine it would be incorporated into the compiler without having additional dependencies</p>



<a name="215877959"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215877959" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215877959">(Nov 06 2020 at 17:29)</a>:</h4>
<p>I have to deal with a mixture of checked and wrapping arithmetic</p>



<a name="215878077"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215878077" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215878077">(Nov 06 2020 at 17:30)</a>:</h4>
<p>so really having a <code>Checked</code> wrapper similar to <code>Wrapping</code> would be nice, especially when some things are checked and some things wrap</p>



<a name="215878246"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215878246" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215878246">(Nov 06 2020 at 17:31)</a>:</h4>
<p>e.g. a block cipher or universal hash function may need <code>Wrapping</code>, but the counter for a nonce should be <code>Checked</code> to prevent overflow</p>



<a name="215879438"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215879438" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215879438">(Nov 06 2020 at 17:40)</a>:</h4>
<p>I don't think a <code>Checked</code> wrapper  is possible because it returns a <code>Result</code> instead of a number, unless you want it to panic on overflow. <code>Saturating</code> would be nice though</p>



<a name="215883232"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215883232" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215883232">(Nov 06 2020 at 18:12)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> check out <a href="https://internals.rust-lang.org/t/where-is-std-saturating-going-to-pre-rfc/13053/27">https://internals.rust-lang.org/t/where-is-std-saturating-going-to-pre-rfc/13053/27</a></p>



<a name="215883293"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215883293" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215883293">(Nov 06 2020 at 18:13)</a>:</h4>
<p>also <a href="https://docs.rs/checked/">https://docs.rs/checked/</a></p>



<a name="215883712"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215883712" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215883712">(Nov 06 2020 at 18:16)</a>:</h4>
<p>So <code>Checked</code> wrapper allows you to delay handling of the overflow - run a bunch of operations and only check if the overflow occurred at a later date. Is that correct?<br>
You can do that with <code>?</code> operator already, but that short-cirquits</p>



<a name="215952929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215952929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215952929">(Nov 07 2020 at 12:31)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245622">Oliver Braunsdorf</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215764727">said</a>:</p>
<blockquote>
<p>Can you tell me what would be current best practice to detect such bugs in Rust? Can Miri detect potential overflows?</p>
</blockquote>
<p>there is <code>-C overflow-checks</code> to enable overflow checks even for release mode...<br>
EDIT: oh you already found that :)</p>



<a name="215958072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958072">(Nov 07 2020 at 14:45)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> what I like the most about wrapper types is they don't let you do unchecked arithmetic</p>



<a name="215958124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958124">(Nov 07 2020 at 14:46)</a>:</h4>
<p>it isn't about what's "possible", it's about making the undesired things unexpressible and the safe thing ergonomic</p>



<a name="215958143"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958143" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958143">(Nov 07 2020 at 14:47)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> but that only helps if you instruct the person linking a crate into an executable to do it, and if they don't, you don't get the checks</p>



<a name="215958403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958403">(Nov 07 2020 at 14:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/unchecked.20arithmetic/near/215958143">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> but that only helps if you instruct the person linking a crate into an executable to do it, and if they don't, you don't get the checks</p>
</blockquote>
<p>that's fair... overflow checks are inserted (or not) during MIR building, so this <em>could</em> be controlled on a per-crate basis, but I am not sure if e have the flags for that</p>



<a name="215958430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958430">(Nov 07 2020 at 14:53)</a>:</h4>
<p>btw, speaking of Miri, it sets <code>-C debug-assertions=on</code> so it will detect overflows the same way rustc would with that flag</p>



<a name="215958525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958525">(Nov 07 2020 at 14:55)</a>:</h4>
<p>but if your goal is just to find overflows, it'll be much faster to set that flag for your test suite and run it the regular way, than using miri ;)</p>



<a name="215958575"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958575" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958575">(Nov 07 2020 at 14:56)</a>:</h4>
<p>what I'd like to do is catch the overflows the test suite doesn't find when they happen in production</p>



<a name="215958589"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/215958589" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#215958589">(Nov 07 2020 at 14:56)</a>:</h4>
<p>yeah... miri obviously cannot help with that</p>



<a name="216022068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216022068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216022068">(Nov 08 2020 at 19:45)</a>:</h4>
<p>(nit: the subject having "unchecked" here made me think <a href="https://doc.rust-lang.org/nightly/std/intrinsics/fn.unchecked_add.html"><code>unchecked_add</code></a>, which is the UB-on-overflow version.  But that's the complete opposite of what's being looked for here <span aria-label="upside down" class="emoji emoji-1f643" role="img" title="upside down">:upside_down:</span>)</p>



<a name="216028772"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216028772" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216028772">(Nov 08 2020 at 22:32)</a>:</h4>
<p>haha yeah I honestly would be happy with a type that enforces panic-on-overflow but a slightly fancier combinator-ish type which doesn't panic-on-overflow would be even nicer</p>



<a name="216028777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216028777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216028777">(Nov 08 2020 at 22:32)</a>:</h4>
<p>with the provision that the type makes unchecked/wrapping arithmetic impossible</p>



<a name="216028807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216028807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216028807">(Nov 08 2020 at 22:33)</a>:</h4>
<p>I panic in those scenarios with the assumption that other logic is supposed to prevent the panic, but avoiding a panic would also be nice</p>



<a name="216028808"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216028808" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216028808">(Nov 08 2020 at 22:33)</a>:</h4>
<p>but then it gets complicated</p>



<a name="216028860"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216028860" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216028860">(Nov 08 2020 at 22:34)</a>:</h4>
<p>if the question is should an operation which overflows interact with secret/key material at all, ideally the answer is no</p>



<a name="216029439"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/unchecked%20arithmetic/near/216029439" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/unchecked.20arithmetic.html#216029439">(Nov 08 2020 at 22:48)</a>:</h4>
<p><span aria-label="bike" class="emoji emoji-1f6b2" role="img" title="bike">:bike:</span> <span aria-label="house" class="emoji emoji-1f3e0" role="img" title="house">:house:</span> <code>core::num::Panicky&lt;T&gt;</code></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>